+++ This bug was initially created as a clone of Bug #27032 +++ FreeRDP 2.2.0 has been released, fixing a security issue: https://github.com/FreeRDP/FreeRDP/releases/tag/2.2.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9 Fedora has issued an advisory for this on July 30: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/ Advisory: ======================== Updated freerdp packages fix security vulnerability: Integer overflow due to missing input sanitation in rdpegfx channel. The input rectangles from the server are not checked against local surface coordinates and blindly accepted. A malicious server can send data that will crash the client later on (invalid length arguments to a memcpy) (CVE-2020-15103). The freerdp package has been updated to version 2.2.0, fixing this issue and other bugs. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16135 https://github.com/FreeRDP/FreeRDP/releases/tag/2.2.0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4r38-6hq7-j3j9 ======================== Updated packages in core/updates_testing: ======================== freerdp-2.2.0-1.mga7 libfreerdp2-2.2.0-1.mga7 libfreerdp-devel-2.2.0-1.mga7 from freerdp-2.2.0-1.mga7.src.rpm
MGA7-64 Plasma on Lenovo B50 No installation issues. Ref bug 24074 I cann't go any further than clean install, since I have no Windows version I can test against (rdp blocked in Windows 10 Home)
CC: (none) => herman.viaene
You can enable RDP on Linux with xrdp and test against that.
$ uname -a Linux localhost.localdomain 5.6.14-desktop-2.mga7 #1 SMP Wed May 20 23:14:20 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux Aug 17 20:48:07 localhost.localdomain [RPM][4346]: erase lib64freerdp2-2.1.2-1.mga7.x86_64: success Aug 17 20:48:07 localhost.localdomain [RPM][4346]: install lib64freerdp2-2.2.0-1.mga7.x86_64: success Aug 17 20:48:07 localhost.localdomain [RPM][4346]: install freerdp-2.2.0-1.mga7.x86_64: success Aug 17 20:48:07 localhost.localdomain [RPM][4346]: erase lib64freerdp2-2.1.2-1.mga7.x86_64: success Aug 17 20:48:07 localhost.localdomain [RPM][4346]: install lib64freerdp2-2.2.0-1.mga7.x86_64: success Aug 17 20:48:07 localhost.localdomain [RPM][4346]: install freerdp-2.2.0-1.mga7.x86_64: success I set up a VirtualBox instance for remote access. Tested it from a Windows PC and then turned around and used RDP. $ xfreerdp /v:192.168.10.113:3389 everyone displayed as expected. This is working as designed.
Whiteboard: (none) => MGA7-64-OKCC: (none) => brtians1
Advisory and package list in Comment 0.
CC: (none) => sysadmin-bugsKeywords: (none) => validated_update
CC: (none) => ouaurelienKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0338.html
Status: NEW => RESOLVEDResolution: (none) => FIXED